Authorization Flaw in Pagelayer Website Builder Plugin for WordPress

CVE-2026-2470

What is CVE-2026-2470?

The Pagelayer plugin, used for drag-and-drop website building in WordPress, contains an Incorrect Authorization vulnerability that affects all versions up to and including 2.0.9. This flaw arises from the pagelayer_save_content AJAX handler, which improperly allows authenticated users to persist metadata of contact templates on posts, including those that are pending. Specifically, users with basic post-edit capabilities can exploit this weakness since the pagelayer_contact_submit endpoint accesses user-controlled post/form identifiers without proper context checks. Consequently, this can enable authenticated attackers, even with Contributor-level access, to set arbitrary configurations for contact form templates, which can be submitted without authentication. This vulnerability can potentially be combined with other issues, such as CVE-2026-2442, to amplify the risk and provide greater control over how outbound emails are handled, making it essential for users to apply immediate updates.

References